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DETAILED ACTION 
Response to Arguments 

1 . Applicant's arguments filed 4/22/2008 have been fully considered but they are 
not persuasive. 

2. Applicant's arguments fail to comply with 37 CFR 1.111 (b) because they amount 
to a general allegation that the claims define a patentable invention without specifically 
pointing out how the language of the claims patentably distinguishes them from the 
references. 



Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or deschbed as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the phor art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 7 and 19 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Cookmeyer et al. (US 6,529,954 B1), hereafter Cookmeyer, in view of Ma et al. (Mining 
Event Data for Actionable Patterns, 2000), hereafter Ma. 

5. Regarding claim 7, Cookmeyer shows a computer-based method of providing 
decision support to an analyst in accordance with an event management system 
(Abstract) which manages a network with one or more computing devices (Figs. 2 and 
7), the apparatus comprising 

at least one processor operative to perform: (i) an automated offline analysis of 
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data representing past events associated witli tlie networl< of computing devices being 
managed by tlie event management system (Figs. 8 and 28 and col. 21 lines 44 - 55, 
where the data source is a locally held log of network events, stored on a 'C:' local hard 
drive, and where the 'analyzer' is a local, non-network device connected to the host 
machine over a local bus (col. 7 lines 18-22), thus containing no 'online' 
activity/analysis), the automated analysis comprising generation of one or visualizations 
of one or more portions of the past even data and discovery of one or more patterns in 
the past even data (Figs. 8, 18, 21-23 and 28, and col. 22 line 61 - col. 23 line 7); and 
(ii) automated rule offline management comprising construction and validation of one or 
more rules (col. 12 lines 33-67 and col. 13 lines 3-20; where rule creation/customization 
is done on the host machine and where executed code is 'downloaded' from the host to 
the analyzer (col. 8 lines 25-30) as an offline operation as this 'download' is over a local 
parallel bus (col. 7 lines 20-25 and Fig. 2, where item 26=host, item 27=parallel cabel 
and item 28=analyzer) formed in accordance with the automated offline analysis of the 
past even data (col. 21 lines 44-55 and Fig. 14), wherein one or more rules are 
constructed offline and validated offline based directly on at least a portion of the one or 
more visualizations generated offline (col. 1 lines 50-67 and col. 22 lines 13-33; where 
rules can be created and constructed by users) from the corresponding offline analysis 
of the one or more portions of the past even data and the offline discovery of at least a 
portion of the one or more patterns in the past event data (col. 13 line 5 - col. 14 line 20 
and col. 12 lines 28-30); and 

memory, coupled to at least the one processor, which stores at least a portion of 
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results associated witli tlie automated offline event analysis and offline rule 
management operations (col. 26 lines 36-44 and col. 10 lines 26-28); 

wherein past event data is obtained from an event database and the one or more 
rules are provided to a rule database, the even database and the rule database being 
associated with an execution system of the event management system (col. 25 lines 37- 
43). 

wherein generation of the one or more visualizations of the one or more portions 
of the past even data further comprises shows selecting a subset of the past even data 
from the event database, generating a visualization of the subset of past even data 
using a visualization tool, the analyst reviewing the visualization to determine whether 
there are any groupings of events that are of interest presented therein, and performing 
an appropriate action where an event grouping of interest is found (col. 22 line 61 - col. 
23 line 7, col. 23 lines 40 - 60, and col. 24 lines 44 - 64). 

Cookmeyer also shows selecting a subset of the past event data from the event 
database (col. 22 line 61 - 23 line 7 and col. 24 lines 44 - 64), generating a visualization 
of the one or more patterns using a visualization tool (col. 22 lines 50 - 63 and col. 24 
lines 44 - 64), the analyst reviewing the visualization to determine whether there are any 
patterns of interest presented therein (col. 22 lines 50 - 63 and col. 24 lines 44 - 64), 
and performing an appropriate action where a pattern of interest is found (col. 24 lines 
44-64). 

Cookmeyer does not show wherein discovery of the one or more patterns in the 
past event data further comprises mining a subset of the past even data to discover one 
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or more patterns using a mining tool; 

wlierein validation of the one or more rules further comprises selecting a subset 
of the past event data from the event database, finding one or more instances of 
patterns expressed in terms of left-hand side rules, generating a visualization of the one 
or more pattern instances using a visualization tool, analyzing the left-hand side rules 
using a rule validation tool, displaying the results of the analysis operation, the analyst 
assessing the analysis results, and making the rules as one of validated and not 
validated based on the assessment of the analyst; 

wherein construction of the one or more rules further comprises selecting a 
subset of the past event data from the event database, mining the subset of the past 
event data to discover the one or more patterns using a mining tool, assessing 
significance of the one or more patterns using a visualization tool, constructing the one 
or more rules from a selected subset of the one or patterns using a rule construction 
tool, and writing the one or more rules in a rule database. 

Ma shows wherein discovery of the one or more patterns in the past event data 
further comprises mining a subset of the past even data to discover one or more 
patterns using a mining tool (pg. 4 section 2, algorithm 1); 

wherein validation of the one or more rules further comprises selecting a subset 
of the past event data from the event database (Ma, pg. 4, paragraphs 3 and 4), finding 
one or more instances of patterns expressed in terms of left-hand side rules (Ma, pg. 2, 
paragraphs 2 and 3), generating a visualization of the one or more pattern instances 
using a visualization tool (Ma, pg. 2, paragraphs 3 and 4), analyzing the left-hand side 
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rules using a rule validation tool (Ma, pg. 1, Fig. 1), displaying the results of the analysis 
operation (Ma, Fig. 3), the analyst assessing the analysis results (Ma, pg. 3, 1®' 
paragraph) and making the rules as one of validated and not validated based on the 
assessment of the analyst (Ma, pg. 9, Fig. 6); 

wherein construction of the one or more rules further comprises selecting a 
subset of the past event data from the event database (Ma, pg. 6, paragraph 2), mining 
the subset of the past event data to discover the one or more patterns using a mining 
tool (Ma, pg. 6 paragraph 3), assessing significance of the one or more patterns using a 
visualization tool (Ma, pg. 2, paragraph 3 and pg. 3 paragraph 2), constructing the one 
or more rules from a selected subset of the one or patterns using a rule construction 
tool (Ma, pg. 3, paragraph 3), and writing the one or more rules in a rule database (Ma, 
Fig. 1 and pg. 2 paragraph 2). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Cookmeyer with that of Ma in order to improve the 
ability to identify patterns in enterprise event management (Ma, pg. 3, bottom right), 
thus improving the ability of Cookmeyer's disclosure to identify, diagnose and give 
advice to solve problems (as Cookmeyer's ability to identify and provide solutions to 
problems is based on identifying patterns). 

6. Regarding claim 1 9, Cookmeyer in view of Ma further show an event 
management decision support system for providing decision support to an event 
management system which manages a network with one or more computing devices 
(Cookmeyer, Abstract, Figs. 2 and 4, and Ma, Fig. 1), the system comprising: 
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an event analysis module, further comprising an event mining module (Ma, Fig. 
1 ) and an event visualization module (Cookmeyer col. 21 lines 44-55 and Figs. 8 and 
28) wherein the event module discovers patterns in event data, and wherein the event 
visualization module provides a mechanism for visualizing at least a result of a pattern 
discovery and rule analysis (Ma, pg. 8 and Cookmeyer Figs. 8, 18, 21-23 and 28, col. 
22 line 61 - col. 23 line 7); and 

a rule management module, further comprising a rule validation module and a 
rule construction module (Cookmeyer col. 12 lines 33 - 67 and col. 14 lines 3 - 20), 
wherein the rule validation module maintains consistency of at least a rule with the even 
data, and wherein the rule construction module provides a mechanism for constructing 
one or more rules based on event patterns mined by the event mining module 
(Cookmeyer, col. 13 line 5 - col. 14 line 20 and col. 12 lines 28 - 30 and Ma, Fig. 1), 

wherein one or more of the rules are constructed offline by the rule construction 
module and validated offline by the rule validation module based directly on at least a 
portion of the one or more visualizations generated offline by the event visualization 
module from the corresponding offline analysis of the one or more portions of the event 
data and the offline discovery of at least a portion of the one or more patterns in the 
event data by the event mining module (Ma, pg. 2 paragraph 3 and 4, pg. 3 paragraph 3 
and Cookmeyer col. 1 2 lines 50 - 67 and col. 22 lines 1 3 - 33); 

wherein past event data is obtained from an event database and the one or more 
rules are provided to a rule database, the even database and the rule database being 
associated with an execution system of the event management system (Cookmeyer; 



Application/Control Number: 09/976,540 Page 8 

Art Unit: 2142 

col. 25 lines 37-43). 

wherein generation of the one or more visualizations of the one or more portions 
of the past even data further comprises shows selecting a subset of the past even data 
from the event database, generating a visualization of the subset of past even data 
using a visualization tool, the analyst reviewing the visualization to determine whether 
there are any groupings of events that are of interest presented therein, and performing 
an appropriate action where an event grouping of interest is found (Cookmeyer; col. 22 
line 61 - col. 23 line 7, col. 23 lines 40 - 60, and col. 24 lines 44 - 64) 

wherein the discovery of the one or more patterns in the past even data further 
comprises selecting a subset of the past event data from the event database 
(Cookmeyer, col. 22 line 61 - 23 line 7 and col. 24 lines 44 - 64); mining a subset of the 
past even data to discover one or more patterns using a mining tool (Ma, pg. 4 section 
2, algorithm 1), generating a visualization of the one or more patterns using a 
visualization tool (Cookmeyer, col. 22 lines 50 - 63 and col. 24 lines 44 - 64), the analyst 
reviewing the visualization to determine whether there are any patterns of interest 
presented therein (Cookmeyer, col. 22 lines 50 - 63 and col. 24 lines 44 - 64), and 
performing an appropriate action where a pattern of interest is found (Cookmeyer, col. 
24 lines 44 - 64); 

wherein validation of the one or more rules further comprises selecting a subset 
of the past event data from the event database (Ma, pg. 4, paragraphs 3 and 4), finding 
one or more instances of patterns expressed in terms of left-hand side rules (Ma, pg. 2, 
paragraphs 2 and 3), generating a visualization of the one or more pattern instances 
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using a visualization tool (Ma, pg. 2, paragraphs 3 and 4), analyzing the left-hand side 
rules using a rule validation tool (Ma, pg. 1, Fig. 1), displaying the results of the analysis 
operation (Ma, Fig. 3), the analyst assessing the analysis results (Ma, pg. 3, 1®' 
paragraph) and making the rules as one of validated and not validated based on the 
assessment of the analyst (Ma, pg. 9, Fig. 6); 

wherein construction of the one or more rules further comprises selecting a 
subset of the past event data from the event database (Ma, pg. 6, paragraph 2), mining 
the subset of the past event data to discover the one or more patterns using a mining 
tool (Ma, pg. 6 paragraph 3), assessing significance of the one or more patterns using a 
visualization tool (Ma, pg. 2, paragraph 3 and pg. 3 paragraph 2), constructing the one 
or more rules from a selected subset of the one or patterns using a rule construction 
tool (Ma, pg. 3, paragraph 3), and writing the one or more rules in a rule database (Ma, 
Fig. 1 and pg. 2 paragraph 2). 

Conclusion 

7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 



Application/Control Number: 09/976,540 Page 10 

Art Unit: 2142 

the advisory action. In no event, liowever, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JOHN M. FRINK whose telephone number is (571) 272- 
9686. The examiner can normally be reached on M-F 7:30AM - 5:00PM EST; off 
alternate Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571) 272-3868. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
John Frink 
(571)272-9686 
/Andrew Caldwell/ 

Supervisory Patent Examiner, Art Unit 2142 
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